S22–4 days
Clients swear your quotation never arrived and Gmail files you under spam. Your mailboxes are fine; the domain's authentication or the shared IP's reputation is not. We rebuild SPF, DKIM and DMARC, clear blacklists, and prove it with live tests before you pay.
Two or more of these mean the cause is domain authentication or IP reputation — both fixable without changing your mail provider.
What we need from you: DNS panel access (we can guide you screen by screen), 15 minutes on a call, and one test mailbox.
Numbers we measure, not adjectives we claim. This is the shape of a typical single-domain rescue.
| Service | Before | After we finish |
|---|---|---|
| SPF | PermError / 2 records | 1 record, under 10 lookups, pass |
| DKIM | no selector / key mismatch | 2048-bit, dkim=pass |
| DMARC | missing or p=none | p=quarantine + rua reports |
| Mail-Tester | 3.1 / 10 | 10 / 10 |
| Gmail auth results | spf=softfail dkim=none | spf=pass dkim=pass dmarc=pass |
| Blacklists | 2 active listings | clean, under monitoring |
Nett — No SST charged
We read your DNS and mail headers, check MX, SPF, DKIM, DMARC and the major blacklists, then send a real test message to Gmail and Outlook.
Records go out one at a time, propagation is watched, then everything is re-tested from Gmail, Outlook and Yahoo until every line reads as pass.
You get the written report and a 7-day watch. The invoice only follows a 10/10 result you can reproduce yourself.
sifumail.com runs the same stack we sell, so our own domain is the showroom. Check our SPF, DKIM and DMARC before you talk to us — and if we are ever red on our own checks, ask us why.
No. SPF, DKIM and DMARC are separate DNS records; mailboxes, folders and rules stay untouched. DMARC starts at p=none so nothing is blocked while we watch, and each record is published and tested one at a time.
Sometimes no, and we say so during the free diagnosis — before you pay. If the shared IP is listed on a major blacklist and the host will not act, the honest options are an isolated sending subdomain for transactional mail or moving the mailboxes. Both are quoted separately; we do not sell a rescue that cannot work.
Authentication works as soon as DNS propagates, usually under an hour. Reputation recovers over 3 to 14 days of clean sends, longer if there were complaints or a hijacked mailbox. Our 7-day watch covers that stretch and flags any slide back.
No. DNS records and one test mailbox are enough. The only exception is Google Workspace DKIM rotation, where we ask for a temporary admin delegate you revoke afterwards — never a password sent in chat.
One sample rejected message plus your domain is enough. You will have a five-point diagnosis within one working day, and a fixed price before any work starts.